0.29.0 — who asked, and two defaults moved toward safety
Principal in the ledger. The PROVE chain now records who, not just what. A declared name tag
(PROXIMO_PRINCIPAL) stamps every entry; on the network faces, signed ES256 caller badges pinned by
the operator (PROXIMO_CALLER_KEYS_DIR) refuse an unverifiable caller fail-closed at the one shared
perimeter. Identity, never authority — the Proxmox token ACL stays the only authorization boundary.
Opt-in and inert until configured: an unconfigured deployment's ledger bytes are unchanged.
Command-body redaction is now ON by default. It was the only default in the box on the wrong
side of zero trust: ct_exec / ct_psql / pve_agent_exec bodies routinely carry a password on an
argv, and the PROVE ledger is a durable file. Full-body recording is now the deliberate act, and an
unrecognised value keeps redaction ON so a typo cannot silently disable it. Breaking if you
relied on full bodies for forensics — set PROXIMO_LEDGER_REDACT=0 explicitly.
A ~16% cheaper doorway, with no loss of surface. Full surface 276,000 → 231,700 tokens; one
plane 97,000 → 81,900; one domain 8,900 → 7,750. A nullable-anyOf collapse that is the identical
JSON Schema, and proximo_target no longer advertised on a box with no target registry to name it.
Routing is unchanged — it has always run off the injected kwarg, never the advertised schema.
Five independent review passes ran before this shipped, and they found more in our own work than
in the feature: a crash-safety ledger entry that dropped attribution, a network face tagging its own
remote requests as the local channel, a pin store that followed a symlinked directory and accepted a
world-writable key file, and a revocation guarantee in SECURITY.md that was false against a running
process. Each was fixed in the code rather than softened in the prose.